AN ANALYSIS OF TECHNICAL SECURITY CONTROL REQUIREMENTS FOR DIGITAL I&C SYSTEMS IN NUCLEAR POWER PLANTS
Instrumentation and control systems in nuclear power plants have been digitalized for the purpose of maintenance and precise operation. This digitalization, however, brings out issues related to cyber security. In the most recent past, international standard organizations, regulatory institutes, and...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Elsevier
2013-10-01
|
| Series: | Nuclear Engineering and Technology |
| Subjects: | |
| Online Access: | http://www.sciencedirect.com/science/article/pii/S1738573315300498 |
| _version_ | 1819241264810295296 |
|---|---|
| author | JAE-GU SONG JUNG-WOON LEE GEE-YONG PARK KEE-CHOON KWON DONG-YOUNG LEE CHEOL-KWON LEE |
| author_facet | JAE-GU SONG JUNG-WOON LEE GEE-YONG PARK KEE-CHOON KWON DONG-YOUNG LEE CHEOL-KWON LEE |
| author_sort | JAE-GU SONG |
| collection | DOAJ |
| description | Instrumentation and control systems in nuclear power plants have been digitalized for the purpose of maintenance and precise operation. This digitalization, however, brings out issues related to cyber security. In the most recent past, international standard organizations, regulatory institutes, and research institutes have performed a number of studies addressing these systems cyber security. In order to provide information helpful to the system designers in their application of cyber security for the systems, this paper presents methods and considerations to define attack vectors in a target system, to review and select the requirements in the Regulatory Guide 5.71, and to integrate the results to identify applicable technical security control requirements. In this study, attack vectors are analyzed through the vulnerability analyses and penetration tests with a simplified safety system, and the elements of critical digital assets acting as attack vectors are identified. Among the security control requirements listed in Appendices B and C to Regulatory Guide 5.71, those that should be implemented into the systems are selected and classified in groups of technical security control requirements using the results of the attack vector analysis. For the attack vector elements of critical digital assets, all the technical security control requirements are evaluated to determine whether they are applicable and effective, and considerations in this evaluation are also discussed. The technical security control requirements in three important categories of access control, monitoring and logging, and encryption are derived and grouped according to the elements of attack vectors as results for the sample safety system. |
| first_indexed | 2024-12-23T14:21:09Z |
| format | Article |
| id | doaj.art-454174d347db49a0a2421c901b10747d |
| institution | Directory Open Access Journal |
| issn | 1738-5733 |
| language | English |
| last_indexed | 2024-12-23T14:21:09Z |
| publishDate | 2013-10-01 |
| publisher | Elsevier |
| record_format | Article |
| series | Nuclear Engineering and Technology |
| spelling | doaj.art-454174d347db49a0a2421c901b10747d2022-12-21T17:43:47ZengElsevierNuclear Engineering and Technology1738-57332013-10-0145563765210.5516/NET.04.2012.091AN ANALYSIS OF TECHNICAL SECURITY CONTROL REQUIREMENTS FOR DIGITAL I&C SYSTEMS IN NUCLEAR POWER PLANTSJAE-GU SONGJUNG-WOON LEEGEE-YONG PARKKEE-CHOON KWONDONG-YOUNG LEECHEOL-KWON LEEInstrumentation and control systems in nuclear power plants have been digitalized for the purpose of maintenance and precise operation. This digitalization, however, brings out issues related to cyber security. In the most recent past, international standard organizations, regulatory institutes, and research institutes have performed a number of studies addressing these systems cyber security. In order to provide information helpful to the system designers in their application of cyber security for the systems, this paper presents methods and considerations to define attack vectors in a target system, to review and select the requirements in the Regulatory Guide 5.71, and to integrate the results to identify applicable technical security control requirements. In this study, attack vectors are analyzed through the vulnerability analyses and penetration tests with a simplified safety system, and the elements of critical digital assets acting as attack vectors are identified. Among the security control requirements listed in Appendices B and C to Regulatory Guide 5.71, those that should be implemented into the systems are selected and classified in groups of technical security control requirements using the results of the attack vector analysis. For the attack vector elements of critical digital assets, all the technical security control requirements are evaluated to determine whether they are applicable and effective, and considerations in this evaluation are also discussed. The technical security control requirements in three important categories of access control, monitoring and logging, and encryption are derived and grouped according to the elements of attack vectors as results for the sample safety system.http://www.sciencedirect.com/science/article/pii/S1738573315300498Instrumentation and Control SystemsNuclear Power PlantCyber SecurityTechnical Security ControlsCritical Digital Assets |
| spellingShingle | JAE-GU SONG JUNG-WOON LEE GEE-YONG PARK KEE-CHOON KWON DONG-YOUNG LEE CHEOL-KWON LEE AN ANALYSIS OF TECHNICAL SECURITY CONTROL REQUIREMENTS FOR DIGITAL I&C SYSTEMS IN NUCLEAR POWER PLANTS Nuclear Engineering and Technology Instrumentation and Control Systems Nuclear Power Plant Cyber Security Technical Security Controls Critical Digital Assets |
| title | AN ANALYSIS OF TECHNICAL SECURITY CONTROL REQUIREMENTS FOR DIGITAL I&C SYSTEMS IN NUCLEAR POWER PLANTS |
| title_full | AN ANALYSIS OF TECHNICAL SECURITY CONTROL REQUIREMENTS FOR DIGITAL I&C SYSTEMS IN NUCLEAR POWER PLANTS |
| title_fullStr | AN ANALYSIS OF TECHNICAL SECURITY CONTROL REQUIREMENTS FOR DIGITAL I&C SYSTEMS IN NUCLEAR POWER PLANTS |
| title_full_unstemmed | AN ANALYSIS OF TECHNICAL SECURITY CONTROL REQUIREMENTS FOR DIGITAL I&C SYSTEMS IN NUCLEAR POWER PLANTS |
| title_short | AN ANALYSIS OF TECHNICAL SECURITY CONTROL REQUIREMENTS FOR DIGITAL I&C SYSTEMS IN NUCLEAR POWER PLANTS |
| title_sort | analysis of technical security control requirements for digital i c systems in nuclear power plants |
| topic | Instrumentation and Control Systems Nuclear Power Plant Cyber Security Technical Security Controls Critical Digital Assets |
| url | http://www.sciencedirect.com/science/article/pii/S1738573315300498 |
| work_keys_str_mv | AT jaegusong ananalysisoftechnicalsecuritycontrolrequirementsfordigitalicsystemsinnuclearpowerplants AT jungwoonlee ananalysisoftechnicalsecuritycontrolrequirementsfordigitalicsystemsinnuclearpowerplants AT geeyongpark ananalysisoftechnicalsecuritycontrolrequirementsfordigitalicsystemsinnuclearpowerplants AT keechoonkwon ananalysisoftechnicalsecuritycontrolrequirementsfordigitalicsystemsinnuclearpowerplants AT dongyounglee ananalysisoftechnicalsecuritycontrolrequirementsfordigitalicsystemsinnuclearpowerplants AT cheolkwonlee ananalysisoftechnicalsecuritycontrolrequirementsfordigitalicsystemsinnuclearpowerplants AT jaegusong analysisoftechnicalsecuritycontrolrequirementsfordigitalicsystemsinnuclearpowerplants AT jungwoonlee analysisoftechnicalsecuritycontrolrequirementsfordigitalicsystemsinnuclearpowerplants AT geeyongpark analysisoftechnicalsecuritycontrolrequirementsfordigitalicsystemsinnuclearpowerplants AT keechoonkwon analysisoftechnicalsecuritycontrolrequirementsfordigitalicsystemsinnuclearpowerplants AT dongyounglee analysisoftechnicalsecuritycontrolrequirementsfordigitalicsystemsinnuclearpowerplants AT cheolkwonlee analysisoftechnicalsecuritycontrolrequirementsfordigitalicsystemsinnuclearpowerplants |